build.yml

name: Build Cross-build environment for pyodide-build

on:
  pull_request:
  push:
    branches:
      - main
    tags:        
      - '*' 
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.12"

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install system-level dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
          cmake bzip2 ccache f2c g++ gfortran git make \
          patch pkg-config swig unzip wget xz-utils \
          autoconf autotools-dev automake texinfo dejagnu \
          build-essential libtool libltdl-dev \
          gnupg2 libdbus-glib-1-2 sudo sqlite3 \
          ninja-build jq xxd

      - name: Cache ccache outputs
        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: /tmp/ccache
          key: ccache-${{ hashFiles('Makefile.envs') }}

      - name: Check out Pyodide, and the NumPy v2 mirror branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: pyodide/pyodide
          ref: main
          path: pyodide_checkout
          submodules: recursive

      - name: Restore cached built packages
        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: |
            pyodide_checkout/packages/.libs/*
            pyodide_checkout/packages/.artifacts/*
            pyodide_checkout/dist/*.whl
          key: pyodide-packages-${{ hashFiles('pyodide_checkout/packages/recipes/**/*.yaml') }}

      - run: echo "PYODIDE_JOBS=$(nproc)" >> "$GITHUB_ENV"

      - name: Build Pyodide packages with NumPy v2 enabled
        working-directory: pyodide_checkout/
        run: |
          source pyodide_env.sh
          ccache -z
          make -C emsdk
          make -C cpython
          pip install -e ./pyodide-build
          PYODIDE_PACKAGES="numpy,scipy,cffi" make
          ccache -s

      - name: Save ccached outputs
        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: /tmp/ccache
          key: ccache-${{ hashFiles('Makefile.envs') }}

      - name: Create cross-build environment
        working-directory: pyodide_checkout/
        run: |
          python tools/create_xbuildenv.py .
          tar cjf xbuildenv.tar.bz ./xbuildenv/

      - name: Upload cross-build environment
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: cross-build-env
          path: |
            pyodide_checkout/xbuildenv.tar.bz
          if-no-files-found: error
          retention-days: 1

  publish:
    runs-on: ubuntu-latest
    needs: [build]
    if: >-
      github.repository == 'pyodide/pyodide-build-environment-nightly' &&
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags'))
    permissions:
      # Required to sign the attestations
      id-token: write
      attestations: write
      # Required to upload to a GitHub release identifier
      contents: write
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: cross-build-env
          path: dist
          merge-multiple: true

      - name: Generate attestations
        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
        with:
          subject-path: |
            dist/xbuildenv.tar.bz
      
      - name: Calc release version
        id: release_version
        shell: bash
        run: |
          echo "release_version=${{ github.ref_name  }}" >> $GITHUB_OUTPUT

          cat $GITHUB_OUTPUT

      - name: Verify them, to ensure that the wheels they were attested correctly
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          gh attestation verify dist/xbuildenv.tar.bz --repo ${{ github.repository }}

      - name: Create GitHub release with these wheels
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        with:
          files: |
            dist/*.tar.bz
          fail_on_unmatched_files: true
          name: ${{ steps.release_version.outputs.release_version }}